Thread: Exploit in Classipress

Exploit in Classipress

I believe I might have found an expoit in Classipress, or at least it seems like it. I have had problems using the fb integration in the latest version meaning I have to log out of fb if I want to login to cp as admin since I once tried the facebook connect to login to cp. Even if I delete my fb user in cp admin, it recreates itself if I'm logged into fb when I go to cp! That's scary.... Well, regarding the exploit, I was logged as admin into cp, tabbed a new page and logged into fb. then went back to cp (forgot to log out of fb) and wanted to do something in cp admin. Then, cp logged out my admin, and auto logged me as my fb id, but admin page remained - partielly. All WP related liniks went away, but cp related links remained. I was able to browse all cp related items in admin as my fb user which do not have admin right. It didn't seem like I had any admin rights, I could not edit or delete anything and when I tried to add an ad, screen layout was messed up. But I believe normal users is not supposed to be able to be anywhere in the admin backend, right?